Metered Access

Crain's Detroit Business is a metered site. Print and digital subscribers have unlimited access to stories, but registered users are limited to eight stories every 30 days. After viewing three metered stories, you'll be asked to register or log in. After eight more stories in 30 days, you'll be asked to subscribe.

End of support for Windows XP no security threat, area banks say

Until recently, Windows XP ran about 95 percent of the ATMs in the U.S.

Banks, credit unions and industry analysts say customers have little to worry about as a result of Microsoft Corp. ending support last week for its 12-year-old Windows XP operating system, which until recently ran about 95 percent of the 440,000 ATMs in the United States.

The ending of support means that as hackers find new ways into XP systems, Microsoft won't be doing patches or issuing security updates to fix problems. People using XP systems, whether on their home computers or at businesses they deal with, eventually could be at risk.

Some banks, like Troy-based Talmer Bank and Trust, have upgraded ATM systems to other newer operating systems. Some, like PNC Bank and J.P. Morgan Chase, have signed contracts with Microsoft to continue supporting XP-based machines.

"Banks are on top of this. There's no risk to the public," said Dennis Koons, president and CEO of the Lansing-based Michigan Bankers Association. "From the consumers' point of view, this is a non-event."

The problem of XP-enabled ATMs is not especially urgent, Avivah Litan, an analyst at the research firm of Gartner Inc., told Bloomberg.

Banks with ATMs running XP "will need to get off of it eventually, but it's not an emergency situation," said Litan, who said banks and cash-machine operators long ago took extra security precautions to seal off ATM software from hackers.

However, industry analysts say, consumers might think twice about using independent ATMs not affiliated with banks.

"The industry is well aware of the problem. We've been gearing up for it," said David Provost, president and CEO of Talmer Bank.

Talmer began upgrading the software at its 77 ATMs just after the first of the year, at a cost of between $5,000 and $7,000 per machine, and is almost done, Provost said.

"The vast majority of our ATMs run over an isolated network," said Kathleen Pitton, vice president of corporate communications at Comerica Bank. "Because it's on an isolated network, it doesn't have the potential vulnerability that others are facing. Only two of our ATMs in Michigan require conversion to Windows 7."

Comerica has about 640 ATMs nationwide, about 350 of them in Michigan.

"We have been well aware of Microsoft's plan to discontinue support for Windows XP and have made our plans accordingly," said Jack Riley, senior vice president and market director for Fifth Third Bank in Michigan.

Community bankers say they are on top of the situation, too.

Farmington Hills-based Level One Bank has eight ATMs, and all are being upgraded to Windows 7.

"In the meantime, the current ATM Windows XP software is secure. ... Many of the features enabled for a PC are purposefully disabled on an ATM, making a breach of security impossible," said Patrick Fehring, the bank's president and CEO.

Flagstar Bank, the largest brick-and-mortar bank headquartered in Michigan, with $9.4 billion in assets — Ally Bank is bigger but has no branches — has 137 ATMs. "We have taken steps to mitigate the sunsetting of XP, and we are confident that there is no material risk," said Susan Cherry-Bergesen, director of corporate communications.

Milford-based Huron Valley State Bank is a tiny bank, with two branches and $90 million in assets. Its president and CEO, Jack Shubitowsky, said the bank will not only pay the $5,000 that Ohio-based Diebold Inc. is charging to upgrade each of his three ATM's software, but he is paying an additional $1,000 to upgrade to software that will be compatible with chip-embedded credit and debit cards when they are introduced next year.

Farmington Hills-based Community Choice Credit Union, which has $531 million in assets, has also decided to do an upgrade at its 11 ATMs that will incorporate the new chip technology, according to chief technology officer Dan Monroe.

Paul Mazur, the chief information officer at Novi-based Vibe Credit Union, said Vibe replaced its 14 ATMs last summer, with advanced technology platforms that will make the current upgrade to Windows 7 much cheaper than the standard upgrade price of $5,000.